Hi
You are overstating the security risk of a single library package that is unused.
Single library? It looked to me as if the whole set of files that make up mysql and postgresql were being pulled in and loaded on the system.
bloat is a more valid point that security risks IMHO.
disabled services dont present much of a security risk.